2020 Class-Action-News: Family and Children's services of Lanark, Leeds and Grenville.

 2016: Toronto firm files statement of claim against province seeking $75 million over data leak.

Class-Action-News: Family and Children's services of Lanark, Leeds and Grenville. 2020: The plaintiff class is in the process of bringing a motion for Summary Judgment. This essentially asks the Court to determine all issues of liability as against the defendant. This motion will be heard before the end of 2020. Please keep checking back here for further updates. (-See: Material Uncertainty Related to Going Concern-) We draw attention to Note 3 in the financial statements, which indicates that the Society's operating fund revenues exceeded expenses by $206,391 during the year ended March 31, 2020 and, as of that date, the Society's current liabilities exceeded its current assets by $3,866,228. As stated in Note 3, these events or conditions, along with other matters as set forth in Note 3, indicate that a material uncertainty exists that may cast significant doubt on the Society's ability to continue as a going concern. Our opinion is not modified in respect of this matter. https://fcsllg.ca/wp-content/uploads/2020/09/Financial-Statements-2020.pdf SEE MORE: The law firm of Flaherty McCarthy LLP has commenced a multi-million dollar Class Action against Family and Children’s Services of Lanark, Leeds and Grenville, and others, seeking damages arising from a serious and unprecedented privacy breach. The allegations contained in the Statement of Claim have not yet been proven in Court. The proposed Class Proceeding seeks $75 million dollars in damages on behalf of 285 people and their family members whose names were on a list of 285 families involved with children’s services, which was leaked on Facebook. Those affected individuals should receive notice from CAS of the privacy breach. The CAS had contacted 194 of the affected individuals by April 25, 2016. At this point, the matter is a proposed class proceeding. As a class member, you do not have to do anything more to be involved in this lawsuit. You will be a member of the class until you are given the opportunity to opt out, which will be your choice. Class Counsel has commenced and served a new proposed Class Proceeding bearing Court File No. CV-16-557244-00CP. This was necessitated by concerns raised by Counsel for the Crown Defendant that adequate notice of the original action had not been provided in accordance with applicable Statutes. Rather than getting in to a lengthy dispute on this issue, we felt it was more appropriate to commence a fresh action that accorded with the applicable notice provisions. This also allowed us to make several changes to the original claim to further particularize the allegations, causes of action and common issues. This new claim has now been served on all parties. At the appropriate time in the future, we will seek Court approval to discontinue the original action and proceed only on the new action. This does not affect the rights of Class Members in any way. The Honourable Mr. Justice Perell has been appointed as the Judge responsible for managing this proposed Class Proceeding. A Judicial Case Conference was held on October 7, 2016 for the purpose of setting a Certification Motion Schedule. Subsequent to this Conference, the plaintiffs have chosen to discontinue the action against all defendants EXCEPT Family and Children’s Services of Lanark, Leeds and Grenville and Jane Doe. The Certification Motion will proceed in November 2017. The plaintiffs served their Certification Motion Record in January 2017. On December 21, 2017, we were successful in having the lawsuit certified as a class action. The litigation administrator, Deloitte LLP, will be providing notice to class members of the Certification Order and the opt-out process in early 2018. Deloitte LLP will be providing this notice to class members based on their last known contact information stated in the private and confidential FCSLLG document at issue. Therefore, if you are concerned that the document may not have your most recent address and contact information, please contact Deloitte LLP at classactions@deloitte.ca. The Court appointed litigation administrator has now given notice that this matter has been certified as a Class Proceeding, in accordance with the Order of the Court. http://www.casprivacybreach.com/whats-new/ https://ottawacitizen.com/news/local-news/toronto-firm-files-statement-of-claim-against-province-seeking-75-million-over-data-leak ::: M.M. v. Lanark, Leeds and Grenville Children’s Aid Society, 2018 ONSC 5032 (CanLII) 2018-08-23. [20] Ms. Denman, who is the central actor either as a commendable whistleblower or as a deplorable newsmonger and hacker and leaker of confidential information is seriously inconvenienced and possibly prejudiced by having to defend or prosecute the various proceedings in Toronto, where she has been unable to obtain a lawyer to represent her. [5] Ms. Denham delivered a Statement of Defence and included a $15 million Crossclaim against the Society Defendants for negligence, intrusion upon seclusion, breach of section 7 of the Canadian Charter of Rights and Freedoms, defamation, abuse of process, and intentional infliction of emotional distress. [1] In 2016, pursuant to the Class Proceedings Act, 1992,[1] M.M., who had been subject to a child protection inquiry, brought a proposed class action against: (a) Family and Children’s Services of Lanark, Leeds and Grenville (“the Society”), a children’s aid society, then regulated by the Ministry of Children and Youth Services of the Ontario government; (b) Raymond Lemay, the Executive Director of the Society, (b) Tracy MacCharles in her capacity as the Minister of Children and Youth Services, (d) Her Majesty the Queen in Right of Ontario (“Ontario”), and (e) Jane Doe, who was later identified in an Amended Statement of Claim to be (f) Kelley Denham. [2] On December 21, 2017, M.M. moved for certification of her action as a class action. The Defendants consented or did not oppose certification, and the action was certified as a class proceeding against the Society to advance three causes of action; namely: negligence, intrusion upon seclusion and breach of section 7 of the Canadian Charter of Rights and Freedoms; and against Ms. Denham to advance an intrusion upon seclusion claim.[2] [3] In the class action, the Class Members claim $75 million in general, special, and punitive damages from the Society and $1 in damages from Ms. Denham. [4] After the certification of the action, the pleadings were completed. The Society delivered a Statement of Defence and included a Crossclaim for contribution and indemnity from Ms. Denham, whom it blamed for the disclosure of the Class Member’s private and confidential information. [6] Now before the court are several motions for a diverse mix of procedural and evidentiary orders. a. M.M. seeks to discontinue her action against Ms. Denham. b. The Society, which, as noted above, had crossclaimed against Ms. Denham, seeks an Order converting its Crossclaim into a Third Party Claim and converting Ms Denham’s Crossclaim into a Counterclaim in the Third Party Action. c. The Society seeks an Order that the Third Party Action including its Counterclaim be case managed in Toronto as a part of the class action and be tried together with or immediately following the class action. d. The Society seeks a sealing order. The sealing Order is said to be required to address confidentiality concerns arising because of s. 87 (8) of the Child Youth and Family Services Act, 2017[3] and s.70(1) of the Children's Law Reform Act.[4] e. Ms. Denham does not oppose the continuation of the crossclaims within a Third Party Action, but she opposes the request for case management in Toronto and asks the court to transfer the Third Party Action to Perth, where she lives and where apparently she will have a lawyer prepared to act for her in defending the Third Party Action and in prosecuting her Counterclaim. [7] The request for a sealing order, which was not opposed, should be granted. [8] Section 87 of the Child Youth and Family Services Act, 2017 prohibits the publication of information that has the effect of identifying a child who is the subject of a child protection proceeding. [9] In order to defend itself to Ms. Denham’s Crossclaim or Counterclaim, the Society may need to identify a child who is the subject of a child protection proceeding, and the Society is rightly concerned that there be no breach of s.87 of Child Youth and Family Services Act, 2017 or of s.70 (1) of the Children's Law Reform Act. [10] The Society’s request for a sealing order will permit it to defend itself to Ms. Denham’s Crossclaim or Counterclaim without beaching these statutes. [11] Moreover, a sealing order would be appropriate in accordance with the common law test for sealing a court file or otherwise limiting the open court principle.[5] [12] Turning to the other requests for relief, the only area of contention is whether the class action and the third party proceeding should be case managed in Toronto or whether these actions should be transferred and case managed by a judge of the East Region of this court. [13] M.M., who is represented by Flaherty, McCarthy LLP, a downtown Toronto law firm, and the Society Defendants, who are represented by Fasken Martineau DuMoulin LLP, a downtown Toronto law firm oppose the transfer of the action to the East Region. [14] Apart from the location of M.M.’s and the Society Defendants’ lawyers, there is nothing to connect the proposed class action to Toronto. All the events in the class action, all the events in the third party proceedings, and all the events in the counterclaim in the third party proceeding occurred in the East Region. [15] The class action and the third party proceeding are inextricably interwoven, with multiple overlapping issues of fact and law to be determined. There is a substantial overlap between the events of the class action and of the third party proceeding, which should not be separated, and where there is no overlap, the events have no connection to Toronto. [16] Although the current litigation plan does not envision any individual proceedings, if the Class Members were to advance individual claims for idiosyncratic special or general damages caused by the release of the private and confidential information, the venue of those individual proceedings would have no connection to Toronto unless the Class Member happened to have moved. [17] Apart from the convenience to counsel, there are no advantages to having the class action managed in Toronto and there is no advantage to having the various actions determined by trial or by summary judgment motion in Toronto. [18] Ms. Denham’s, M.M.’s and the representative of the Society’s examinations for discover will or should occur in the East Region where the parties reside. [19] The events of the various actions, which attracted the attention of the media in Perth, Ontario, are of interest to the citizens of the East Region, who have an interest in the operation of their local children’s aid societies, but the events are of little more than of prurient interest to the citizens of Toronto. https://www.canlii.org/en/on/onsc/doc/2018/2018onsc5032/2018onsc5032.html ::: Unfair or Indefensible - Costs Against C.A.S.? On behalf of Gene C. Colman Family Law Centre posted in Child Welfare on Tuesday, January 7, 2014. There is a presumption that a successful party is entitled to the costs of a motion, enforcement, case or appeal (Ontario Family Law Rules, R. 24(1)). There is, however, no such presumption for costs in a child protection case (Rule 24(2)). Does that mean that a successful parent can never obtain a costs order against a children's aid society? Let us delve a little further. The lack of presumption for costs is perfectly understandable. The Courts have been hesitant to impose cost orders against children's aid societies as they are faced with the difficult statutory duty of protecting children from harm and the law tells us that they should not be punished (through costs orders) for errors of judgment. A further reason for courts rarely awarding costs against societies stems from the view that societies should not be discouraged from taking action because of the risk of an adverse costs order. Rule 24(2) does not give children's aid societies the authority to behave with impunity though. The courts have (and will) order costs against children's aid societies in limited circumstances. For example the 2013 matter of Catholic Children's Aid Society of Toronto v. SSB awarded costs to the mother and Office of the Children's Lawyer for the procedural failings of the CCAST. This case affirms the courts' approach in awarding costs against children's aid societies in that a society will not be shielded from costs where its behaviour is "unfair or indefensible or where exceptional circumstances exist". In SSB the CCAST sought disclosure of "clinical investigation notes" from the OCL. The OCL claimed that the requested documents were subject to solicitor-client privilege and therefore could not be disclosed as the disclosure would amount to a serious breach of trust between the OCL and the children. The prevailing concern was that the CCAST had sought to obtain the privileged documents on three separate occasions (only to withdraw their motion before a decision could be delivered) and had put the mother and OCL to considerable expense in defending the motions. The judge considered that the repeated attempts to obtain disclosure was tantamount to an abuse of process and verged on acting in bad faith. The judge, most helpfully, summarized the responsibility of the CCAST as follows [at paragraph 12]: ... Like any other litigant, the society must conduct itself according to the rules. It is given broad investigative scope, and cannot and should not be liable for costs for actions it takes in good faith in its duty to investigate cases. That, however, does not give a society licence to ignore the general rules of procedural fairness. When it does, it should be liable in costs. The CCAST matter also made reference to the 2005 decision of Children's Aid Society of Niagara Region v. B. (C.), which provides guidance for the circumstances when children's aid societies should and should not be liable for costs. These can be summarized as follows [paragraphs 89-100]: 1. Bad Faith Not Required: To attract an adverse award of costs, a children's aid society need not have acted in bad faith; 2. Fairness: Costs may be awarded against a society, "where it conducts itself... in a way where it would be perceived by ordinary persons as having acted unfairly"; 3. Indefensible Behaviour: Many cases hold that a children's aid society should only be visited with an adverse award of costs where it has taken a step or position that is "indefensible", ie. "admitting of no defence". 4. Exceptional Circumstances: There is a line of decisions holding that costs should not be awarded against a society "unless exceptional circumstances exist"; 5. Error in Judgment not sufficient to attract costs: A society should not be punished for a mere error of judgement (an error of judgement can truly arise only where one has considered all courses of action reasonably available at the time); 6. Society Not to Be Dissuaded by Costs: A society should not be dissuaded from its statutory mandate by costs considerations; 7. Society to Re-assess Its Position: A children's aid society must be even-handed and act in good faith. To this end a society must be prepared to re-assess its position as an investigation unfolds and more information becomes known; 8. Accountability: "Children's aid societies must be accountable" for the manner in which it investigates a case and in the way it chooses to litigate that case (one method of achieving accountability is through costs sanctions); The judge in CASNR tells us that a society can attract an adverse costs award where it fails in any of the following seven areas (paragraph 102): 1. Investigation before apprehension; 2. Continued investigation after apprehension; 3. Consideration of all appropriate protective measures; 4. Formation of a fair and defensible position; 5. Reassessment of that position as circumstances warrant; 6. Use of properly trained workers; and 7. Accessing independent experts in the field of child psychology. This more critical approach adopted by some courts should provide some modest encouragement to parents who have been subjected to biased investigations or litigation undertaken by a children's aid society where the C.A.S. actions were patently unfair or indefensible. These factors should be relevant not only to a costs determination but also to the expected standard of care to which child protection authority must adhere. Holding these agencies accountable to such standards should hopefully be encouraged by the case management judge as the case unfolds. If you have a matter where a children's aid society has acted unfairly, indefensibly or there are exceptional circumstances, you may benefit from a consultation with our experienced child welfare lawyers. Tags: CAS, Child Custody, Child Protection, Child Welfare, Children's Aid Society, Costs, Procedural Fairness Related Posts: THE EASTER BUNNY AND C.A.S. ABUSE OF POWER, Do's and Don'ts of a CAS Apprehension of Your Child, C.A.S. Attitude: Win child welfare cases at all costs, PROPORTIONALITY, SUMMARY JUDGMENT, SELF REPRESENTED CHILD WELFARE LITIGANTS https://www.complexfamilylaw.com/blog/2018/03/the-easter-bunny-and-cas-abuse-of-power.shtml ::: "Lemay said the person behind the breach is likely a disgruntled client who was “looking to embarrass us.” Lemay says the report in question is not "typical" of the work FCSLLG does or the documentation it keeps. He also says the organization has no reason to believe any of its other clients had their personal information compromised. Identifying those who are involved with children’s aid is illegal under the Child and Family Services Act. Releasing this information carries a fine of up to $10,000 and three years in jail. Lemay said there was a previous breach of the agency in February which did not involve the release of confidential information. The person responsible was a children’s aid client who has been embroiled in a campaign against the agency, including posting hours-long YouTube videos of her interactions with members of the staff. Emotions regarding Children’s Aid Societies can run high, but there is no excuse for anyone to deliberately expose clients, said Lemay. Although there have been other examples of clients who have taken their disputes with children’s aid societies to the internet, Lemay know of no other incidents in which confidential lists of names have been released. The February breach was investigated and the agency’s data systems were reviewed by an external consultant, who assured the agency that its documents were secure. The woman involved also received a lawyer’s letter. “She had to know that this was illegal,” said Lemay. “We live in an era where there are people determined to hack through security systems. Everybody has to be prepared for it,” said Newton. Family and Children’s Services of Lanark, Leeds and Grenville is answering questions from the public and current and former clients at 1-855-667-2726. The case highlights a glaring omission in provincial and federal privacy laws, which do not cover children’s aid societies. Family and Children’s Services of Lanark, Leeds and Grenville and others across the province are not accountable to the Office of the Information and Privacy Commissioner of Ontario or the Office of the Privacy Commissioner of Canada, meaning when a breach like this occurs neither office has the ability to act. In 2013, the former privacy commissioner of Ontario, Anne Cavoukian, called on government to pass new legislation that would require oversight from the privacy commissioners offices in order to ensure that the sensitive data being managed by these agencies was being properly handled and secured. “In my 2004, 2009, and 2012 Annual Reports I recommended that Children’s Aid Societies, which provide services for some of our most vulnerable citizens – children and youth in government care, be brought under FIPPA (the Freedom of Information and Personal Privacy Act),” she wrote in her 2013 annual report. “I am disheartened by the complete lack of action to ensure transparency and accountability by these organizations that received significant public funding. As part of the modernization of the Acts, I call on the government to finally address this glaring omission and ensure that Children’s Aid Societies are added to the list of institutions covered.” The only oversight for the province’s children’s aid agencies comes from Ontario’s Ministry of Children and Youth Services, which has been named as a defendant in Thursday’s statement of claim. Lemay admits the report was on the FCSLLG's website but says it was hidden behind several layers of security including a password given only to the organization's board of directors. "You have to go through the back door. You have to be looking for this," he says. This is the second time in about three months that the organization has had to take down its website because of security concerns. An outside expert was brought in after a February scare to better secure the website. No sensitive information was revealed or even in danger in the first breach, Lemay says. He says they made the changes and were told the website was secure. Share this article in your social network. https://ottawacitizen.com/news/local-news/police-probe-leak-of-ids-of-lanark-leeds-and-grenville-childrens-aid-clients-over-web https://ottawacitizen.com/news/local-news/toronto-firm-files-statement-of-claim-against-province-seeking-75-million-over-data-leak https://ottawa.ctvnews.ca/names-of-285-people-referred-to-children-s-aid-in-lanark-leeds-and-grenville-posted-online-1.2865944 ::: 2019: PAGE 29/30 - Trial Testimony. EXECUTIVE DIRECTOR RAYMOND LEMAY. I was just repeating what had been explained to me. That the security features of the website, when it was first installed, had not been turned on. That’s what was explained to me, and I am just repeating what I heard. Q. So, all you know is whoever C.A.S. retained for you working in your position did something incorrectly with respect to the website that caused this issue? A. That’s what, that’s what I understand, yes. (Does that mean every file FCSLLG upload to the internet and not just client information but every file could have been downloaded by just anyone since FCSLLG's website went online???) READ THE COMPLETE TRIAL TRANSCRIPT HERE: https://www.kelleyandderek.com/ ::: Kelley Denham was found not guilty on several charges: • Mischief over $5,000 (section 430 (1) of the Criminal Code of Canada (CCA); • Mischief of data (section 430 (5) of the CCA); • Unauthorized use of a computer (section 342 of the CCA); • Publication of identifying information (section 85 (3) of the Child and Family Services Act of Ontario — CFSA); and, • Another charge under section 76 of the CFSA, referring to identifying parties to a protected hearing. MAR. 21, 2018 THE FOLLOWING CHARGES AGAINST KELLEY DENHAM WERE DROPPED: 1) Theft under $5000 - s. 334 Criminal Code of Canada 2) Traffick in identity Information - s. 402.2(2) Criminal Code of Canada ::: 2020: THE ONTARIO COURT OF JUSTICE. BETWEEN: HER MAJESTY THE QUEEN -and- KELLY J. DENHAM APPEARANCES: FOR THE CROWN: Mr. Corbella FOR THE DEFENDANT: Mr. Mansour REASONS FOR JUDGMENT These are reasons for judgment concerning Kelly J. Denham who stands charged with the following counts under the Criminal Code of Canada, and the Child and Family Services Act of Ontario, specifically: - Criminal Code s. 430(1.1)(c): that between 31 January 2016 and 18 April 2016 she did obstruct, interrupt or interfere with the lawful use of computer data of the Family and Child Services of Lanark, Leeds and Grenville. - Criminal Code s. 430(1.1)(d): that between 31 January 2016 and 18 April 2016 she did obstruct, interrupt or interfere with a person in the lawful use of computer data, or denied access to computer data to a person who was entitled to access it. 2 - Criminal Code s. 342.1(1)(c): that between 31 January 2016 and 18 April 2016, she did fraudulently and without colour of right, use, or cause to be used, directly or indirectly a computer system with intent to commit an offence under s. 430 in relation to computer data. And under the Child and Family Services Act - Child and Family Services Act of Ontario s. 76: that on 18 April 2016 she published information that has the effect of identifying a witness at, or a participant in a hearing, or a party to a hearing, to wit; the names of clients of Family and Children Services. - Child and Family Services Act of Ontario s. 45(8): on 18 April 2016 did publish information that has the effect of identifying a child who is a witness at, or a participant in a hearing, or the subject of a proceeding, or the child’s parents, or foster parents, or a member of the child’s family, to wit; the names of clients of Family and Children Services. The trial took place before me at Perth. It was agreed by counsel that the information alleging offences under the Criminal Code would be tried together with the information under the Child and Family Services Act of Ontario, with the evidence received applying to both. At the conclusion of the evidence on 15 August 2019, counsel requested and I agreed to an adjournment for oral and written argument. Argument was finally 3 concluded on 17 December 2019, and the matter was adjourned ultimately to this date for judgement. Overview of the Evidence: The facts are not disputed. It is common ground that Ms. Denham had dealings with the Family and Children Services of Lanark Leeds and Grenville, hereinafter referred to by its initials as FCSLLG, an agency accredited and operating under the Child and Family Services Act of Ontario. Those dealings commenced in April 2015. Ms. Denham soon became dissatisfied with the actions of the FCSLLG. In January 2016, Ms. Denham complained in writing to FCSLLG, and subsequently met with the Director. That meeting was secretly taped by Ms. Denham. The FCSLLG on its own initiative had by this time established a computer web site. The object of the website was twofold; they wished to create a public portal that would be open to the public to provide an overview of the applicable legislation of child protection and the agencies role within the community in fulfilling that role, and a private portal to disseminate private information concerning the FCSLLG and its activities that would be available only to its board members. 4 In reality the website created by FCSLLG did not contain an adequate or any firewall limiting access to the portal containing private information. No special skills or deceptive techniques were necessary to gain access to the board information intended to be private. Nor were there any warnings or disclaimers that the information in the private portal was private or confidential and intended only to be seen by the intended restricted group. In effect the information intended for sole use of the FCSLLG board was available to any interested person. It is acknowledged that Ms. Denham accessed the FCSLLG website and entered what was intended to be the private portal. She thereby gained access to the confidential FCSLLG board information including an Excel spreadsheet that contained the names of mothers and families who had been referred to sought out FCSLLG for service. In early February 2016 FCSLLG became aware that a video of the meeting between Ms. Denham and its Director entitled “Full Interview with Director of Service” had been posted to You Tube. During the video various FCSLLG documents that it had considered private and confidential were shown on the screen. When this came to the attention of FCSLLG in early February 2016 FCSLLG shut the website down and hired David Schmidt, the son-in-law of Margaret Row who at the time was employed by FCSLLG as a program manager 5 charged with the responsibility of oversight of the computer site, and instructed him to determine how this had happened and rectify any breach of security. Mr. Schmidt gave evidence at trial and was qualified on consent as an expert in the field of computers in general and in website security analysis. In his investigation of the website, Mr. Schmidt discovered that two IP addresses associated with Ms. Denham had accessed the FCSLLG website files. He further reported on the inherent lack of security in the website and made recommendations to correct and secure the private information. Mr. Schmidt determined that 252 discrete files that the FCSLLG intended to be private had in fact been downloaded, and the defense does not dispute that the accused accessed and downloaded the material. FCSLLG implemented some but not all of Mr. Schmidt’s recommendations. In particular Mr. Schmidt advised that the two-portal system in place on the single website should be separated to provide full security. He recommended that there be two distinct and separate websites, one for each task. Contrary to that recommendation, the private Board portal containing the private documentation intended for Board eyes only remained on the single website, however attempts were made to close the file directory through which it was determined that Ms. Denham had obtained access to the private documentation intended for Board use only. FCSLLG took the position at the time that, contrary 6 to the report of Mr. Schmidt, that this was sufficient security to put the website back on line. In fact, the actions of the FCSLLG, did not secure the private information. On April 18, 2016, Ms. Denham posted a hyperlink of a spreadsheet (0-5intake-stats.xslsx) that contained the names of 285 mothers of children who had had interactions with FCSLLG on the Facebook account of “Smiths Falls Swap Shop”. Smiths Falls Swap Shop is a private group that requires permission for membership and has some minor limiting conditions for membership and agreement that group rules be followed. The link, if clicked, provided direct access to the document on the FCSLLG website. Two women, amongst others, accessed the material and seeing their names complained to FCSLLG concerning the privacy breach. Another woman accessed the link and complained to both FCSLLG and to the police. FCSLLG on being advised of this fresh breach again shut the website down and contacted the police. These charges are the result. THE LAW AND THE SPECIFIC CHARGES: In argument the Crown quite properly cautioned that the competence of the FCSLLG in the manner in which it dealt with the establishment and maintenance 7 of the confidentiality of its clients is not the issue. I agree. The issue is simply whether or not the Crown has established beyond a reasonable doubt that in her actions the accused has violated all elements of the various counts before the Court. As to the charges under s. 430(1.1) of the Criminal Code, the section provides that: Everyone commits mischief who willfully (a) destroys or alters computer data (b) renders computer data meaningless, useless or ineffective (c) obstructs, interrupts or interferes with the lawful use of computer data; or (d) obstructs, interrupts or interferes with a person in the lawful use of computer data or denies access to computer data to a person who is entitled to access to it. The accused is charged under subsections (c) and (d) as set out above. The accused is also charged under s. 342.1(1)(c), which provides: Everyone who, fraudulently and without color of right, (a) obtains, directly or indirectly any computer service; (b) …intercepts or causes to be intercepted, directly or indirectly, any function of a computer system; (c) uses or causes to be used, directly or indirectly, a computer system with intent to commit an offence under paragraph (a) or (b) or an offence under section 430 in relation to data or a computer system,” Section 342.1(2) defines computer system and data as: computer system means a devise that, or a group of interconnected or related devises, one or more of which, (a) contains computer programs or other data, and (b) pursuant to computer programs, (i)performs logic and control, and (ii)may perform any other function; 8 data means representations of information or of concepts that are being prepared or have been prepared in a form suitable for use in a computer system To succeed in relation to the charges under s. 430(1.1) the Crown is required to satisfy the criminal burden and prove, that Ms. Denham; obstructed interrupted or interfered with the lawful use of computer data (subsection (c)), and/or that she obstructed, interrupted or interfered with a person in the lawful use of computer data or denied access to computer data to a person entitled to access to it, and that she did so willfully, that is with knowledge or recklessness as to the consequences of her actions. The Crown’s theory in relation to the criminal counts casts FCSLLG as a victim that as a result of the actions of the accused was obliged to: shut down their website and disable the hyperlink to confidential material; hire a consultant; delete documents; issue a cease and desist letter to the administrator of the Facebook page where the link was posted; and notify proper authorities. Factually the Crown likens the situation to a victim failing to lock its back door and an accused entering and committing mischief to the interior. The rhetorical analogy is not particularly helpful to the analysis. The facts and the applicable law in the charging sections are specific and determinative of the issues. 9 The defense argued the matter on the basis that the actions of the accused were not fraudulent and fraud is a necessary element of the offence; and further that the actions of the accused did not obstruct, interrupt or interfere with the computer data. I note first of all that the focus of these sections is on computer data not hardware or the computer program employed, and I find there was here no obstruction, interruption or interference with the data. Interference is defined in the Dictionary of Canadian Law (Thomson Carswell (third edition) 2004), as: “To obstruct; to disrupt.” On the facts, the accused copied various documents, specifically she copied 252 documents from the FCSLLG website and the hyperlink which, if followed by others by a simple click, would lead them directly to and open spreadsheet (0-5intake-stats.xslsx), information that FCSLLG intended to be private. She did not however alter or destroy any computer data on the website of the FCSLLG. The documents remained available and unaltered at all times. Their delivery was temporarily interrupted at the election of the FCSLLG, once it became apparent that the documents were accessible by the world at large. But the closure of the website was the result of decisions made by FCSLLG once they became aware of the shortcomings of their security provisions. While off line the data remained intact and unaltered. 10 I note that in R. v. Livingston, [2018] O.J. No. 254, the obstruction interruption or interference with the data involved the deliberate erasure or deletion of data, while in R. v. Charania [2012] O.J. No. 5113 a case where an unauthorized user name and password were employed to copy personnel records, the court specifically based its finding not on the taking of the documents, but on the fact that doing so resulted in the complainant being locked out of the computer system. The locking out however was not, as is the case before us, of a decision by the complainant to do so because of a perceived breach of its privacy, but rather an automatic computer programing function, beyond the control of the complainant. The automatic computer function activated by the accused denied access to the complainant. The court held; “In this case, the Crown has specifically proven … that (the accused) actually obstructed and interfered with (the complainant’s) lawful use of data by preventing her from accessing data on the Ritz Villa computer system…The finding of guilt is not based upon the confidentiality of the data in (the complainants’) email account.” (para 120) I cannot find any obstruction, interruption or interference to the data. In the first instance the accused took a picture or copy of the data found on the site. In the second she took a picture or copy of the hyperlink leading to the spread sheet data and posted that to the Smiths Falls Swap Shop web site. It is common ground that the FCSLLG closed down the website on two occasions in order to investigate the supposed security breach and to address the 11 and then readdress and remedy the problem. The evidence shows and I find as a fact that the FCSLLG was in total control of the website. The FCSLLG created it, operated it and chose to shut it down. The cause of the shutdown was the system’s inherent security defect. The accused may have discovered the security shortcomings, she did not however cause those shortcomings nor the shutdown. I agree. The FCSLLG witnesses, Mr. Lemay, Ms. Row, acknowledge that on learning of the inadequacies with the security of the Website, the site was shut down. They acknowledge further that the site would have been closed regardless of the manner in which the security inadequacies were brought to the agency’s attention. The accused demonstrated the inadequacies, but did not create them. Her actions then must be seen on the light of a notifier of the problem but not as a cause. It was the security problem itself that caused the complainant to shut down the website. Turning to the element of fraud. The defense argues that fraud is a necessary element of the charge of unauthorized use of a computer, and that the accused in accessing and downloading the information did not engage in any fraudulent act. As noted previously, the website was theoretically designed for the dual purpose of providing both public and private information. The public was invited to receive public information as to the workings of the FCSLLG; board members 12 were thought to have access to private information unavailable to others. The accused did obtain private information, but was able to do so not through deceit falsehood or other fraudulent means but because of the design flaws inherent in the system. The private information was publicly available. There was no need for a password or user name restricting access. Nor, I find, did the accused require any particular or peculiar skill or ability to gain access. The information was available. This is confirmed in the evidence of Mr. Schmidt, the expert relied upon by FCSLLG: Q: In this case the directory had no password, nothing in it was intended to stop you from getting to it. A: That’s correct. (Transcript p. 105 – 106) The absence of fraud distinguishes the cases relied upon by the Crown. In R. v. Livingston (supra) Lipson J. of this court expressly found: “The totality of evidence proves beyond a reasonable doubt that he was neither justified nor authorized nor had the color of right to arrange for the wiping of the hard drives…He was clearly aware of his obligation to retain records…Nevertheless, (he) resorted to extreme and unauthorized measures to permanently delete records…” (emphasis added) The court went on to find and enumerate the fraudulent methods he employed to do so. That is not this case. Nor is R. v. Charia (supra) where deception was found as a fact to be used to obtain the desired material. 13 I am for those reasons left with a reasonable doubt and unable to find Ms. Denham guilty of the criminal charges before the court. Turning then to the charges under the Child and Family Services Act. Section 45(8) of the Act provides that “No person shall publish or make public information that has the effect of identifying a child who is a witness at or a participant in a hearing or the subject of a proceeding, or the child’s parent or foster parent or a member of the child’s family.” Section 76 of the Act is similar in object and wording, “No person shall publish or make public information that has the effect of identifying a witness at or a participant in a hearing, or a party to a hearing other than a society.” The elements of the offences charged are; the act of publishing or making public; information that has the effect of identifying the specified participants, parties, witnesses or children; who are involved in a hearing or proceeding. The Crown argues that all elements of these offences have been met. On the element of “publishing or making public”, the accused, by posting information on Facebook made that information public. The fact that the particular site on which it was posted, Smiths Falls Swap Shop, requires an application for membership that must be accepted by the sites controllers is irrelevant. Even if the site had only one member it would still constitute publishing. 14 As to the element of “identification” the Crown argues that revealing the client list as set out in spreadsheet 0-5intake-stats.xslsx, some (six) of who were engaged in a hearing is sufficient to satisfy the element of identification. The defense argues that on the facts of this case the Crown has failed to establish that the actions of the accused, constituted publishing or making public information, and has failed to establish that her posts identified a witness, participant or party in a hearing. Section 45(8) was discussed in Children’s Aid Society of Hamilton–Wentworth v. D.–G. (E.), [1995] 21 OR (3d) 643, where Rosenberg J. (as he then was) held on behalf of the Divisional Court, that given the objective of s. 45(8) there must be a link or coupling between the identification of an individual and their involvement in a proceeding or hearing. “The impugned publication must make reference to the proceedings or be contrary to some other provision of the Act to justify an injunction based on the Act. … It must, to offend the Act, require the disclosure that there are proceedings either directly or impliedly and couple the person identified with those proceedings.” Section 76 of the CFSA is similar in object and wording and in my view should be interpreted in the same manner. It is interesting to note that the wording of both sections in restricting publication of information that “has the effect of identifying” is narrower than that used in section 486.4 of the Criminal Code of Canada which 15 authorizes the court to direct the nonpublication of “any information that could identify the victim or a witness…” If the legislature, in drafting the prohibition, sought to cast a wider net it was open to it to do so and the it has chosen not to. The evidence shows that the spreadsheet 0-5intake-stats.xslsx contained some 285 client names. The purpose of the document was to report to the Board on compliance by the agency with ministry service time guidelines. There is no reference in the document to clients or matters that were or had been before the court in any proceeding or hearing. In fact, some six clients listed in the spreadsheet were involved in court proceedings, but on the information in the spreadsheet their identity as participants in court proceedings could not be determined. The evidence was, and I find, that the determination of who if any of the named clients were involved in proceedings and to be able to conclude that anyone was so involved in a hearing or proceeding, required a records search of the legal department by Karen Von Cramon, whose evidence was given by an agreed statement of facts, filed. The website and spreadsheet accessed by the accused did not contain the records of the legal department. They did not contain any information as to who was involved in a hearing or proceeding. The necessary link between 16 the list of client names and their involvement in any hearing or proceeding is absent. The agency does far more than proceed to court to protect children. It provides multiple services to people in the community that do not involve any court proceeding or hearing. The nonpublication provisions only apply to proceedings or hearings. It is not an offence under the Act to divulge the names of persons who are clients of the FCSLLG. I find accordingly that the information contained in the spreadsheet did not have “... the effect of identifying a child who is a witness at or a participant in a hearing or the subject of a proceeding…” as required in s. 45(8) of the Act, nor “…the effect of identifying a witness at or a participant in a hearing, or a party to a hearing…” as set out in s. 76 of the Act. I turn then to second point raised by the defense that being that the accused did not “publish or make public” the information by posting the hyperlink on the Smiths Falls Swap Shop. The terms “publish” and “make public” are not defined in the legislation. The Crown argues that reference to s. 299 of the Criminal Code which, defines publish in the context of the provisions against criminal defamatory libel should apply. That section provides: “A person publishes a libel when he (a) exhibits it in public; 17 (b) causes it to be read or seen; or (c) shows or delivers it with intent that it should be read or seen by the person it defames or by any other person.” The Crown further argues that whatever definition is employed the fact is that “making public”, the alternate wording of the impugned act is satisfied by the simple act of placing information on Facebook. The Crown argues that in this case the accused made the material public by posting the information to Smiths Falls Swap Shop, and that would be so even if the Swap Shop group had only one member. The defense notes that the Information laid particularizes the offence as one of publishing without reference to the alternative of making public. I note that no amendment was sought or granted. That said, given the common definition of “publish” that follows, the point is largely moot. In Re Orr’s Stated Case (sub nom R. Leong), [1961] 38 WWR 114 at para.9 the court noted: “Where the word “publication” is used in a penal statute without definition, and with context which would assign to it a special meaning, it must be considered to bear the meaning it would bear in in ordinary English speech. Certainly, where crime is involved a court should not go out of its way to attribute to the word an extraordinary meaning involving the culpability of the accused, but should rather hew strictly to the line resolving any possible doubt in favour of the accused.” These are propositions that I find to be a fair statement of the law. 18 I turn then to commonly used dictionaries for definitions of the term. In Black’s Law Dictionary “publish” is defined as: to make public, to circulate, to make known to people in general: …An advising of the public or making known of something to the public for a purpose. Webster’s Third New International Dictionary: to declare publicly; make generally known; … to place before the public (as through mass medium), circulate, while Webster’s New Collegiate Dictionary defines “publish” as: to make generally known; to make public announcement of; to place before the public; to produce or release for publication. Lastly, the Canadian Oxford Dictionary defines “publish” as: prepare and issue (a book, a newspaper, information in electronic form, computer software, etc.) for public consumption; make generally known. The accused in this case posted a hyperlink, which if clicked, led directly to the spreadsheet on the FCSLLG website. The test question to be answered is simply, does this action constitute publishing as that term is commonly defined. In Crookes v. Newton, 2011 SCC 47 the Supreme Court held, within the civil context of defamation, that posting a hyperlink to a defamatory document created and controlled by another did not constitute publishing by the person posting the hyperlink. 19 The court outlined the function and effect of a hyperlink in the following terms. “Hyperlinks are, in essence, references. By clicking on the link, readers are directed to other sources. Hyperlinks may be inserted with or without the knowledge of the operator of the site containing the secondary article. Because the content of the secondary article is often produced by someone other than the person who inserted the hyperlink in the primary article, the content on the other end of the link can be changed at any time by whoever controls the secondary page. Although the primary author controls whether there is a hyperlink and what article that word or phrase is linked to, inserting a hyperlink gives the primary author no control over the content in the secondary article to which he or she has linked.” The court then went on to find that this lack of control over the content of the material discoverable through the hyperlink has the effect of making the poster of the hyperlink not the publisher of the material. The court went on: “Communicating something is very different from merely communicating that something exists or where it exists. … Even where the goal of the person referring to a defamatory publication is to expand the publications audience, his or her participation is merely ancillary to that of the initial publisher.” The background and context in Cook v. Newton differs of course from this situation. The FCSLLG as the creator of the spreadsheet intended that it be for the information of board members only. The principles discussed however remain. The accused exercised no control over the contents of the document, she simply provided the reference to its existence, and that, I find, falls short of publishing. For these reasons, again I am left with a reasonable doubt, and am unable to find the accused guilty of these charges under the Child and Family Service Act. 20 CONCLUSION: There will be an acquittal on all charges. Due to the Covid 19 difficulties currently plaguing the nation and closing the court, these reasons are being delivered in writing. The Information is not before me to endorse. If possible, I authorize the clerk of the court to endorse the dismissal on my behalf. Alternatively, I shall endorse the record and Information when next in Perth. DATED AT BROCKVILLE FOR DELIVERY IN PERTH, THIS 1 MAY 2020 Charles D. Anderson, J. https://www.recorder.ca/news/local-news/cas-whistleblower-acquitted ::: Canada: Novel Case On Data Exclusion Interpreted In Favour Of Insureds An Ontario judge recently interpreted a data exclusion in favour of the insureds, ordering the insurer to defend claims arising out of an alleged website security breach.1 A website owned by Family and Children's Services of Lanark, Leeds and Grenville ("FCS"), was breached when an unauthorized party downloaded and published documents stored in a secured section of the website, which contained personal information about individuals who had been the subject of FCS investigations. A broadly worded claim was subsequently brought against FCS, alleging damages resulting from defamation, breach of privacy and other causes of action. Laridae Communications Inc. had provided advice to FCS on the design and security of FCS's website. FCS issued a third-party claim against Laridae. Footnotes: 1 Laridae v Co-Operators, 2020 ONSC 2198. The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances. https://www.mondaq.com/canada/insurance-laws-and-products/942318/novel-case-on-data-exclusion-interpreted-in-favour-of-insureds ::: Court Refuses to Apply Liability Policies’ Electronic Data Exclusions, Cites Lack of Jurisprudence. Laridae v. Co-operators, 2020 ONSC 2198 (CanLII) Earlier in May, in Laridae v. Co-operators, 2020 ONSC 2198, an Ontario court was hesitant to offer guidance on the proper application of two “electronic data exclusions” that expressly withdrew coverage for the misappropriation and display of electronic information on the internet. At issue were allegations arising from particularly egregious hacking incidents involving a child protection agency’s website. Noting an apparent lack of guiding authority (“there is no jurisprudence on the proper interpretation of data exclusion clauses”), Pollak J. ordered a liability insurer to separately defend the named and additional insureds. https://www.canliiconnects.org/en/commentaries/71352 https://www.canliiconnects.org/en/cases/2020onsc2198 ::: 2020: How the lack of cyber case law worked against an insurer in a $75-million data breach lawsuit. The lack of cyber case law worked against an insurer in the Ontario Superior Court of Justice recently, with the court deciding that The Co-operators has a duty to defend two parties named in a $75-million cyber breach class action lawsuit. https://www.canadianunderwriter.ca/insurance/how-the-lack-of-cyber-caselaw-worked-against-an-insurer-in-a-75-million-data-breach-lawsuit-1004179343/ INTERVIEW with Director of Service for Family and Children's Services of Lanark Leeds and Grenville. https://youtu.be/kq6JCx5FlfA This is an audio recording of Kelley Denham's last conversation with FCSLLG's now former director of service Kim Morrow regarding the progress of her complaint detailing FCSLLG's collectively unethical conduct before being arrested and charged by the Smith's Falls police.. The day Miss Denham was charged Kim Morrow again called to discuss the progress of Miss Denham's complaint and left a message on Denham's answering machine. As part of Miss Denham release conditions a no contact order was issued preventing Miss Denham from contacting anyone at FCSLLG or their board members and in fact from completing FCSLLG's needlessly complex complaint process.. https://youtu.be/HALda2OHg4s :::